The present invention relates generally to Internet Protocol (IP) addressing, and more particularly, to a system and method for controlling access to DNS (Domain Name Service) servers.
IP addresses for hosts on the Internet are publicly available by looking up a host URL (Uniform Resource Locator) name via a domain name system. The domain name system is a global network of servers that translate host names like www.nai.com into numerical IP addresses (e.g., 208.228.229.218) which computers on the Internet use to communicate with each other. The Internet makes use of a network of DNS servers to form a distributed database of mappings between domain names and IP addresses and resolve URLs. When a client computer wants to resolve a URL, it queries its DNS server. The client uses a DNS resolver to locate its DNS server. If the DNS server is not authoritative for the destination domain, or if the DNS server does not have the information in its cache, it will not be able to answer the client query immediately. Instead, the DNS server acts as a DNS forwarder or issues a recursive query. A client may also receive a non-authoritative response from a DNS server if the server has found the answer in its cache. A DNS forwarder will forward the query to a second DNS server higher up in the tree of servers. If recursive querying is allowed, the DNS server asks a root name server or the IP address of a host that is authoritative for the destination domain, and then contacts the authoritative server and reports back to the client.
The public availability of IP addresses for specific hosts makes them easy targets for various types of attacks, such as Denial of Service (DoS) attacks. In the connected world of the Internet, destructive individuals can create major network security problems for administrators with systems exposed to public networks. The recent Denial of Service attacks on many of the web's most popular sites makes this clearer than ever before. A Denial of Service attack occurs when a malicious attacker sends continuous TCP/IP packets to a server, which quickly take up resources until there are no more resources available and a system hang or crash occurs. Commonly the targeted site may appear unavailable to the broader Internet because of the saturation of its network segment. Denial of Service attacks can result in significant loss of time and money for many organizations.
Denial of Service attacks are different from most other attacks because they are not targeted at gaining access to a network or information on the network. These attacks focus on making a service unavailable for normal use, which may be accomplished by exhausting some resource limitation on the network or within an operating system or application. Denial of Service attacks are most frequently executed against network connectivity. The goal is to prevent hosts or networks from communicating on the network. There are several types of Denial of Service attacks, which can occur at various levels. When involving specific network server applications, such as a Hypertext Transfer Protocol (HTTP) server or a File Transfer Protocol (FTP) server, these attacks can focus on acquiring and keeping open all of the available connections supported by that server, effectively locking out valid users of the server or service. Denial of Service attacks can also be implemented using other Internet protocols, such as UDP and Internet Control Message Protocol (ICMP).
The most common Denial of Service attack is the SYN attack. This is a network level attack. The attacker sends continuous TCP SYN packets to a server. Each TCP SYN packet clogs the connection until there are no more TCP resources available. The attacker begins the process of establishing a connection to the victim machine, but does it in such a way as to prevent the ultimate completion of the connection. In the meantime, the victim machine has reserved one of a limited number of data structures required to complete the impending connection. The result is that legitimate connections are denied while the victim machine is waiting to complete phony “half-open” connections. This type of attack does not depend on the attacker being able to consume network bandwidth. The intruder may be consuming kernel data structures involved in establishing a network connection. The implication is that an intruder can execute this attack from a dial-up connection against a machine on a very fast network.
Conventional security systems or firewalls attempt to protect a client's identity when requesting information on the network. Systems such as Network Address Translator (NAT) are used to hide internal IP addresses by mapping a global IP address to one or several local IP addresses. Firewalls prevent tampering with private resources by unauthorized users. A network administrator typically establishes a set of rules that specify what types of packets (e.g., from a particular IP address or port) are allowed to pass and what types are blocked. This packet filtering may be effective in dealing with the most common types of network security threats; however, it is often easy to exploit by an experienced hacker. Firewalls may also use proxies. A proxy is a program, running on an intermediate system that deals with servers on behalf of clients. Clients which are attempting to communicate with a network that is protected by a firewall, send requests for connections to proxy based intermediate systems. The proxy relays approved client requests to target servers and relays answers back to clients. These systems generally protect the client's identity rather than providing a security mechanism for servers or hosts. Furthermore, conventional security systems generally do not protect the identity of a public IP address or support mapping between global IP addresses.
Conventional DNS servers provide IP addresses for any host that they have information on or can find information on without any restriction. As shown in FIG. 1, a conventional DNS server receives a plain text request and responds with a plain text response. Since there is no authentication, and clients accept the first DNS reply to be received, DNS is also vulnerable to spoofing. Spoofing occurs when attackers interject themselves into the network in such a manner as to reply faster than a valid DNS server. The attacker thus replies with false information before the real reply arrives. With conventional DNS servers, an IP address cannot be hidden from the general public in order to defeat or prevent DoS and other types of attacks, while still being made available to specific clients. A new security system called DNSSEC (DNS Security) allows DNS servers to verify their domain names and corresponding IP addresses using digital signatures and public-key encryption. A digital signature proves that the message originated from a certain source and that the message has not been changed. The digital signature binds the identity of the originator to the identity of the key used to sign the message. DNSSEC allows DNS servers to authenticate replies and permits clients to authenticate those replies. To prove authenticity of data, an authoritative source creates and digitally signs the data. DNSSEC uses asymmetric cryptography (public key encryption) in which each DNSSEC server has a private key and a widely distributed public key. The DNSSEC server creates a digital signature with its private key, and the client verifies the signature with the public key corresponding to the private key. This allows a DNS client to verify that an answer it receives in response to its query came from an authorized source. DNSSEC, however, only provides authentication of a DNS reply to clients. DNSSEC does not allow an IP address to be hidden in a reply and cannot be used to defeat or prevent DoS and other types of attacks.
There is, therefore, a need for a method and system for controlling responses to requests made of a DNS server so that at least some of its mappings from domain names to IP addresses are accessible only to specified clients or clients that can authenticate themselves to the DNS server.